What is port 5985 used for?

Default TCP port used by WinRM for WS-Management sessions over HTTP.

Transport protocol

TCP

Role and operation

The client opens an HTTP connection to the WinRM listener and WS-Management carries commands and responses. With integrated authentication methods such as Kerberos/Negotiate, message content can receive protocol-level protection; WinRM HTTPS on port 5986 adds TLS to the transport.

Security precautions

Restrict 5985 to trusted management networks and hosts. Avoid weak authentication methods and prefer WinRM HTTPS on 5986 when TLS is required or traffic crosses a less trusted network.

Should this port be opened in the firewall?

Allow TCP 5985 only from required administration workstations, servers, or management subnets. Do not expose it directly to the Internet.

How to verify this port

Test-NetConnection SERVER -Port 5985 checks TCP reachability. Complete the test with Test-WSMan or a PowerShell

Port/service mappings are common conventions. An application can be configured to use a different port.